A Malta-based cryptocurrency trading exchange platform OKEx has explained how hackers gained access into its trading cryptocurrencies platform stealing $5.6 million worth of Ethereum Classic in the process.
Funded in 2017, OKEx becomes the latest victims of crypto scams across the world just at a time a surge in the price of bitcoin and other cryptos is driving traders a little bit crazy.
In the latest report, OKEx explained how the Ethereum Classic 51% attacker stole $5.6 million from the digital currency exchange on August 1.
How $5.6M Worth of Ethereum Classic Was Stolen on OKEx
June 26 to July 9: OKEx explained that the hacker had been planning the attack since late June by first creating at least five accounts between June 26 to July 9 on the crypo platform.
By creating those accounts, they reportedly lay the ground for the attack.
July 30 to July 31: Between July 30 through July 31, the attacker reportedly deposited 68,230.02 ZEC across their five newly registered accounts and on July 31st, the attacker exchanged their ZEC for 807,260 ETC (worth $5.6 million at the time of action) and subsequently deposited their ETC to an external wallet address, the report says.
It was gathered that the attacker allegedly purchased enough hash power from Nicehash provider daggerhashimoto so that they could control 51% of the Ethereum Classic network.
When they controlled more than 51% of the hash on the network, the attacker began to “dubiously” mining the ETC blockchain, but not broadcasting the blocks that they mined to other miners, coingeek.com explained.
With the shadow chain being mined but not broadcasted, the attacker sent their 807,260 ETC back to OKEx, traded all of the ETC for 78,941.356 ZEC, and immediately withdrew their ZEC to an external wallet.
However, while the attacker made this move on the main chain, on the shadow chain, the attacker sent their 807,260 from one external wallet to another external ETC wallet that they controlled.
Once their ZEC withdrawal was confirmed on OKEx, the attacker broadcast the shadow chain—which was the longest chain with the most hash power supporting it—to the other ETC miners, who quickly accepted that chain as the most valid version of the ETC blockchain.
As a result, the ETC that the hacker originally used to buy their 78,941.356 ZEC was back in their possession, and since their ZEC withdrawal had already been confirmed, they had their ZEC as well as their illicit 807,260 ETC secured in their external wallet.
With the funds in hand and OKEx out $5.6 million, the ETC attacker considered their attack a success.
What’s OKEx is doing moving forward?
OKEx has blacklisted all of the addresses associated with the attacker and suspended the attacker’s five OKEx accounts.
It has also suspended all ETC deposits and withdrawals until the ETC network is considered stable.
It also plans to increase the confirmation time for ETC transactions in the near future in order to reduce the size of the attack vector that allowed the ETC 51% attacker to get away successfully.
It’s indeed a challenging moment for cryptocurrency exchange platforms across the world as hackers continue to deploy their tactics to explore a slight vulnerability.
